llvm / llvm/llvm-project

[clang][analyzer] False positive: non-inlined recursive call invalidates an unchanged pointer

Open
#222,313 3 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

**Description:**
A proven non-null var constraint is lost across a call to a static recursive function.

**Reproducer:**
```c
void clang_analyzer_eval(int);
void clang_analyzer_explain(void *);

static void a(int **p, unsigned n)
{
if (n)
a(p, n-1);
}

int entry(unsigned n)
{
int x = 0;
int *p = &x;

a(&p, n);
clang_analyzer_eval(p != 0); // TRUE and FALSE, expected only TRUE
clang_analyzer_explain(p); // symbol of type 'int *' conjured at CFG element

return *(p ? p : 0); // core.NullDereference
}
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported result with the clang static analyzer using the C snippet in the issue, then trace how the non-inlined static recursive call handles the unchanged pointer constraint. Done means the analyzer reports only TRUE for p != 0 and does not report core.NullDereference for the final dereference.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.